Security audit
Security checks for vulnerabilities and agentic risk
This skill provides a user-controlled storyboard workflow with disclosed cloud rendering and local API-key storage.
Install only if you accept dLazy processing your prompts and uploaded reference media. Prefer device-code login over placing a key directly in a command. The installation commands specify version 1.2.3 despite one stale 1.0.9 reference; this review does not certify the external CLI implementation.
The supplied code performs only a login command and contains no storyboard planning or rendering behavior. Nothing supplied establishes that this authentication is a supporting requirement of the declared workflow. The command's underlying implementation and any credential handling are not visible.
The supplied code performs only authentication configuration; it contains no storyboard planning, rendering, or workflow logic. Nothing supplied establishes that dlazy authentication supports the declared storyboard purpose, so this is an unrelated capability rather than a demonstrated implementation detail. The snippet does not establish credential exfiltration or any specific network activity.
The only supplied command performs a login operation rather than implementing the declared storyboard workflow. Nothing in the supplied content establishes authentication as a supporting requirement for that workflow. The command's implementation is unavailable, so credential handling, network access, and other side effects cannot be determined.
The supplied chunk only configures CLI authentication; it contains no storyboard planning or rendering behavior. Authentication could support a rendering integration, but no such integration or dependency is established here. The observed purpose therefore differs materially from the declared workflow. The chunk does not establish whether credentials are persisted or transmitted.
The supplied chunk delegates execution to a general external command rather than implementing or visibly directing the described plan-first storyboard process. Although a CLI could be a supporting implementation detail, this chunk supplies no storyboard-specific command or workflow connecting it to that purpose. The CLI's downstream behavior cannot be determined from this snippet; no specific malicious activity is established.
The only supplied behavior is a generic external CLI invocation, which does not substantiate the declared storyboard purpose. It could be a supporting implementation detail if the package and command implement that workflow, but the supplied chunk provides no such connection. The package's actual capabilities and downstream effects cannot be determined from this snippet.
No suspicious patterns detected.
